Homeland 
Security 

Daily Open Source Infrastructure Report 

02 September 2014 

Top Stories 

• The FBI stated that a suspect known as the “No Boundaries Bandit” was responsible for the 
August 25 robbery of a TCF Bank branch in River Forest, the twelfth bank robbery linked 
to the suspect in the Chicago metro area. - Chicago Sun-Times (See item 9 ) 

• The Pennsylvania Department of Environmental Protection released details of 243 
incidents where natural gas drilling operations contaminated private drinking water wells, 
with most cases occurring in northeastern counties. - Associated Press (See item 18 ) 

• Dell SecureWorks researchers published an analysis of the CryptoWall ransomware and 
found that it is the largest ransomware threat, extorting at least $1 million from victims, 
and also reported that researchers detected around 625,000 infected systems between mid- 
March and late August, encrypting over 5.25 billion files. - The Register (See item 24 ) 

• A 3-alarm fire August 28 tore through Hilltop United Methodist church in Pittsburgh, 
Pennsylvania, which houses two congregations and the Allentown Senior Citizens Center, 
causing an estimated $1.5 million in damage. - Pittsburgh Post-Gazette (See item 26 ) 
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Energy Sector 

1. August 28, Lexington Herald-Leader - (Kentucky) Coal company fines total $245,000 
in environmental cases in Bell, Pike counties. Apollo Fuels in Bell County and Coal 
Operator 1 LLC in Pike County were both cited by federal and State regulators for 
violating environmental rules in eastern Kentucky including allegedly burying stream 
areas without a permit at a surface coal mine and illegally discharging contaminants 
into a creek. Proposed fines totaled $245,000 against the two companies. 

Source: http://www.kentuckv.com/2014/08/28/3400443 coal-company-fines-total- 
245000.html ?rh=l 

2. August 28, Reuters - (Ohio) Power producer Duke Energy to retire coal-fired 

plants in Ohio. Duke Energy Corp., announced August 28 that it will retire Units 5 and 
6 September 1 at its WC Beckjord Station in New Richmond, Ohio, as part of their plan 
to stop coal-fired power generation at the site by January 2015. 

Source: http://www.reuters.com/article/2014/08/28/duke-energv-powerstation- 
idUSL3N0QY54C20 140828 

3. August 28, Great Falls Tribune - (Montana) Refinery employees, city firefighters 
treated for chemical exposure. A Great Falls firefighter and two Calumet Refinery 
employees were transported to an area hospital August 27 due to low-level exposure to 
hydrogen sulfide at the Montana refinery. The hydrogen sulfide was confined to the 
property and officials stated that the public was not at risk for exposure. 

Source: http://www.greatfallstribune.com/storv/news/local/2014/08/28/refinerv- 
employees-city-firefighters-treated-chemical-exposure/14741505/ 

4. August 27, Buffalo News - (New York) Tonawanda Coke settles OSHA case tied to 
plant explosion. Tonawanda Coke Corp., and Kirchner LLC reached a $1 15,370 
settlement with the Occupational Safety and Health Administration (OSHA) over 
alleged safety violations at the company’s River Road plant in New York related to a 
January 31 explosion that injured 3 workers. The company has either corrected or is in 
the process of fixing issues identified by OSHA. 

Source: http://www.buffalonews.com/business/tonawanda-coke-settles-osha-case-tied- 
to-plant-explosion-20 140827 

For another story, see item 18 
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Chemical Industry Sector 

5. August 28, U.S. Environmental Protection Agency - (Rhode Island) Clean Air 
settlement with R.I. Chemical Manufacturer will minimize emissions. Mereco 
Technologies Group, Inc., agreed to pay $60,000 in penalties to settle U.S. 
Environmental Protection Agency allegations claiming that the Rhode Island chemical 
manufacturer failed to comply with federal and State air pollution regulations. The 
settlement will also require the company to apply for a Rhode Island Clean Air Act 
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permit, develop a plan to reduce emissions, and update its business policies and 
procedures. 

Source: 

http://vosemite.epa.gOv/opa/admpress.nsf/0/257EEFC72DC72D6A85257D4200580981 
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Nuclear Reactors, Materials, and Waste Sector 

6. August 29, Connecticut Day - (Connecticut) NRC issues ‘white’ finding on 
Millstone. The U.S. Nuclear Regulatory Commission issued a preliminary ‘white’ 
finding for a safety violation at the Millstone Power Station’s Unit 3 turbine-driving 
auxiliary feedwater pump, which could lead to increased inspections. The plant’s 
operator stated that the issue was caused by an incorrect bearing in the pump between 
August 2013 and January 2014. 

Source: http://www.thedav.com/article/20140828/NWS01/140829678/1047/NWS 
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Critical Manufacturing Sector 

Nothing to report 
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Defense Industrial Base Sector 

Nothing to report 
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Financial Services Sector 

7. August 29, Softpedia - (International) New BlackPoS strain disguises as antivirus 
service. Researchers with Trend Micro identified a new variant of the BlackPoS point- 
of-sale (PoS) malware that disguises itself as an antivirus product and contains other 
changes to improve efficiency and avoid detection. The malware can reach PoS 
systems by the infection of company servers, breaching network communication, or 
infecting the PoS device before deployment. 

Source: http://news.softpedia.com/news/New-BlackPoS-Strain-Disguises-As- 
Antivirus-Service-456982.shtml 

8. August 28, Reuters - (Georgia) Ex-LPL broker ordered to pay $1.9 million in U.S. 
SEC fraud suit. A Buford man who previously worked as a broker for LPL Financial 
LLC was ordered by a federal judge to pay over $1.9 million for diverting clients’ 
funds for his personal use. The man previously agreed to a court order with the U.S. 
Securities and Exchange Commission related to the fraud. 
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Source: http://www.reuters.com/article/2014/08/28/us-sec-broker-fraud- 
idUSKBN0GS26K20140828 



9. August 27, Chicago Sun-Times - (Illinois) FBI: No Boundaries Bandit who robbed 
Northlake bank strikes in River Forest. The FBI stated that a suspect known as the 
“No Boundaries Bandit” was responsible for the August 25 robbery of a TCF Bank 
branch in River Forest, the twelfth bank robbery linked to the suspect in the Chicago 
metro area. 

Source: http://franklinpark.suntimes.com/2014/08/28/no-boundaries-bandit-bank- 
robber-wanted/ 

10. August 27, Associated Press - (Washington) Police seek clothes-swapping 
Washington bank robber. The FBI and police are searching for a suspect dubbed the 
“Quick Change Bandit” thought responsible for three bank robberies in the Puget 
Sound area of Washington between August 16 and August 18. 

Source: http://www.oregonlive.com/pacific-northwest- 
news/index.ssf/2014/08/police seek clothes-swapping w.html 

For additional stories, see items 23 and 25 
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Transportation Systems Sector 

11. August 29, USA Today - (Massachusetts) Another plane diverts over reclining seat 
dispute. An American Airlines flight from Miami to Paris, France, diverted to Boston’s 
Logan Airport August 27 after a dispute between two passengers and a flight attendant 
that resulted in one passenger being subdued and handcuffed by two plain-clothes 
Federal Air Marshals during the flight. 

Source: http://www.wusa9.com/storv/news/nation/2014/08/29/reclined-seat-dispute- 
diverts-flight-boston/14790979/ 

12. August 29, Chicago Tribune - (Illinois) At least 14 injured in shuttle bus crash at 
O’Hare Airport. At least 14 individuals were injured when a shuttle bus crashed into a 
median on its way to terminals at O’Hare International Airport in Chicago August 29. 
All lanes of the Interstate 190 entrance were closed for 2 hours while officials worked 
to clear the scene. 

Source: http://cltv.com/2014/08/29/at-least-2-iniured-in-shuttle-bus-crash-at-ohare- 
airport/ 

13. August 28, Santa Barbara Noozhawk - (California) Teen killed in crash that shut 
down Northbound Highway 101. Northbound lanes of Highway 101 in Santa Barbara 
reopened August 28 after closing for more than 7 hours due to a fatal accident 
involving a semi-truck and wrong- way driver August 27. The teenage driver of the 
vehicle was killed after clipping the front end of the semi-truck and flipping over. 
Source: 

http://www.noozhawk.com/article/fatal crash shuts down northbound highway 101 
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14. August 28, Durango Herald - (Colorado) 2 die in area highway accidents. One 
person was killed and 2 others were injured in a 3-vehicle crash on U.S. Highway 160 
near Cortez August 28 that prompted the closure of all lanes for more than 2 hours. In a 
separate incident a motorcyclist was killed after colliding with a vehicle on U.S. 
Highway 550 near Silverton. 

Source: http://www.durangoherald.com/article/20140828/NEWS01/140829544/Fatal- 
accident-closes-Hwy-550- 
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Food and Agriculture Sector 

15. August 28, WTSP 10 St. Petersburg - (Florida) Roaches, temperatures violations 
close Clearwater restaurant. Country Harvest Restaurant in Clearwater reopened the 
week of August 25 after Florida health inspectors ordered a temporary emergency 
closure after an inspection revealed 25 health code violations in the restaurant’s 
kitchen. The restaurant underwent a deep-cleaning and was cleared to reopen by State 
inspectors. 

Source: http://www.wtsp.com/storv/news/investigations/2014/08/28/country-harvest- 
restaurant-clearwater-roaches-moldy-olives/147 15467/ 

16. August 28, Food Safety News - (International) Texas Cyclospora cases linked to 
Mexican cilantro. The Texas Department of State Health Services reported August 28 
that at least 126 Cyclospora-related sicknesses in Texas since May 1 were connected to 
fresh cilantro imported from Mexico, and announced that the outbreak was considered 
over. At least 21 of the cases related to the outbreak were traced to four restaurants in 
North Texas that served cilantro sourced from Puebla, Mexico. 

Source: http://www.foodsafetvnews.com/2014/08/texas-cvclospora-cases-linked-to- 
cilantro-from-mexico 



17. August 28, U.S. Food and Drug Administration - (Arizona; Nevada; New Mexico) 

Dole Fresh Vegetables announces allergy alert and voluntary limited recall of 
DOLE-branded spinach due to possible contamination by walnuts. The U.S. Food 
and Drug Administration announced August 28 that Dole Fresh Vegetables issued a 
voluntary recall for limited amounts of its 6-ounce bags of DOFE Baby Spinach and 8- 
ounce bags of DOFE Spinach due to possible contamination with walnuts. The 
products were distributed in Arizona, Nevada, and New Mexico. 

Source: http ://w w w.fda. gov/S afety/Recalls/ucm4 1215 6 .htm 
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Water and Wastewater Systems Sector 

18. August 29, Associated Press - (Pennsylvania) Online list IDs Pa. water wells harmed 
by drilling. The Pennsylvania Department of Environmental Protection released details 
of 243 incidents where natural gas drilling operations contaminated private drinking 
water wells, with most cases occurring in northeastern counties. Impacts on wells 
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included methane gas contamination, dry wells, wastewater or pollutant spills, or other 
issues that rendered wells undrinkable. 

Source: http://www.pressconnects.com/storv/news/local/pennsvlvania/2014/08/29/gas- 
drilling-water-contamination/14792457/ 

19. August 28, ABC News - (Louisiana) Brain-eating amoeba found in Louisiana water 

supply. The Louisiana Department of Health and Hospitals stated that the Naegleria 
fowleri amoeba was detected in the water system in St. John the Baptist Parish, serving 
around 12,577 people in three towns. There were no reports of infections and the 
system will be flushed with higher levels of chlorine for 60 days to ensure that any 
amoeba is destroyed. 

Source: http://abcnews.go.com/Health/brain-eating-amoeba-found-louisiana-water- 
supplv/story?id=25 1 60247 



[ Return to top ] 



Healthcare and Public Health Sector 



20. August 28, U.S. Environmental Protection Agency - (New York) EPA takes action to 
protect public from hazardous waste fines SUNY Downstate Medical Center for 
improper storage and handling of hazardous waste. SUNY Downstate Medical 
Center was issued a legal complaint by the U.S. Environmental Protection Agency 
August 28 and faces fines up to $156,710 for violating federal hazardous waste laws in 
two buildings in its Brooklyn, New York campus. An investigation determined the 
hospital generated and improperly stored chemical wastes in corroded and leaking 
containers. 

Source: 

http://vosemite.epa.gOv/opa/admpress.nsf/0/14E560483C6A0D0985257D42005AC2D9 
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Government Facilities Sector 



21 .August 28, WKRN 2 Nashville - (Tennessee) Water main break keeps 2 Coffee 
County schools closed. Union Elementary School and Coffee County Middle School 
in Tennessee remained closed August 28 following a water main break on State Route 
53/Woodbury Highway that prompted the early dismissal of classes August 27. 
Source: http://www.wkrn.com/storv/26384895/water-main-break-coffee-countv- 
schools 



22. August 28, Waterloo Cedar Falls Courier - (Iowa) Two Waterloo schools cancel day 
due to power outage. A power outage caused by a fault in an underground line 
prompted the dismissal and cancellation of classes at Lou Henry Elementary and 
Hoover Middle schools in Waterloo August 28. Utility crews spent more than 3 hours 
restoring service. 

Source: http://wcfcourier.com/news/local/education/two-waterloo-schools-cancel-day- 
due-to-power-outage/article 297 699c 1 -dab3-54 1 1 -8a2e-96e69029a865 .html 
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Emergency Services Sector 

Nothing to report 
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Information Technology Sector 

23. August 29, Softpedia - (International) Hackers steal customer payment data from 
ClamCase. Keyboard and iPad case manufacturer ClamCase stated that attackers 
compromised the company’s systems and obtained an undisclosed number of 
customers’ personal information including names, addresses, and payment card data. 
The company stated that the attack occurred between April 15 and August 6 and is 
offering identity theft prevention services to affected customers. 

Source: http://news.softpedia.com/news/Hackers-Steal-Customer-Payment-Data-From- 
ClamCase-456961.shtml 



24. August 29, The Register - (International) KER-CHING! CryptoWall ransomware 
scam rakes in $1 MEEELLION. Dell SecureWorks researchers published an analysis 
of the CryptoWall ransomware and found that it continues to be the largest ransomware 
threat, extorting at least $1 million from victims. The researchers detected around 
625,000 systems infected with the ransomware between mid-March and late August, 
encrypting over 5.25 billion files, among other findings. 

Source: http://www.theregister.co.uk/2014/08/29/crvptowall analysis/ 

25. August 29, Help Net Security - (International) Phishers targeting crypto currency 
and retail sites. The Anti-Phishing Working Group (APWG) released its report for the 
second quarter of 2014 (Q2) and found that the number of phishing attacks was the 
second-highest number since recording began in 2008, with online payment services 
and cryptocurrency sites being frequent targets, among other findings. 

Source: http://www.net-security.org/secworld.php ?id= 17308 

For another story, see item 7 



Internet Alert Dashboard 



To report cyber infrastructure incidents or to request information, please contact US-CERT at soc@us-cert.gov or 
visit their Web site: http://www.us-cert.gov 

Information on IT information sharing and analysis can be found at the IT ISAC (Information Sharing and 
Analysis Center) Web site: http://www.it-isac.org 
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Communications Sector 



Nothing to report 
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Commercial Facilities Sector 

26. August 29, Pittsburgh Post-Gazette - (Pennsylvania) Fire rips church that was 
'heartbeat' of city's Allentown section. A 3-alarm fire August 28 tore through Hilltop 
United Methodist church in the Allentown neighborhood of Pittsburgh which houses 
two congregations and the Allentown Senior Citizens Center. Officials reported that 
workers performing maintenance on the church’s roof may have accidentally sparked 
the fire that left an estimated $1.5 million in damage. 

Source: http://www.post-gazette.com/local/city/2014/08/28/Lire-hits-Allentown- 
church-and-senior-center/stories/201408280309 

27. August 28, Fresno Bee - (California) Three-alarm fire hits apartment building in 
central Fresno. An August 28 fire that started between the Cameron Park and Dakota 
Gardens apartment complexes in central Fresno spread to the structures and sparked a 
3-alarm blaze that displaced 19 residents and caused damage to 7 units in the 2 
buildings. Total damage was estimated at $80,000. 

Source: http://www.modbee.com/2014/08/28/3509135 two-alarm-fire-hits- 
apartment.html 

28. August 28, Softpedia - (International) Dairy Queen confirms breach of payment 
systems. Dairy Queen officials confirmed that systems in a limited number of stores 
were infected with Backoff point-of-sale (PoS) malware, and customers’ personal 
information, including payment card information, may have been exposed. 

Source: http://news.softpedia.com/news/Dairv-Queen-Confirms-Breach-of-Payment- 
Systems-456832.shtml 

29. August 28, Elyria Chronicle-Telegram - (Ohio) Lorain church destroyed in fire; 
pastor vows to rebuild. Authorities are investigating an August 28 fire that caused a 
roof collapse at the First Evangelical Lutheran Church in Lorain and destroyed the 
building and its contents, including an organ valued at nearly $1 million. 

Source: http://chronicle.northcoastnow.com/2014/08/28/lorain-church-destroyed-fire- 
pastor- vows-rebuild/ 

Lor another story, see item 7 
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Dams Sector 

Nothing to report 
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NTAS 

NO ACTIVE ALERTS 
www.DHS.gov/alerts 



Department of Homeland Security (DHS) 

DHS Daily Open Source Infrastructure Report Contact Information 

About the reports - The DHS Daily Open Source Infrastructure Report is a daily [Monday through Friday] 
summary of open-source published information concerning significant critical infrastructure issues. The DHS Daily 
Open Source Infrastructure Report is archived for 10 days on the Department of Homeland Security Web site: 
http://www.dhs.gov/IPDailyReport 

Contact Information 

Content and Suggestions: Send mail to cikr.productfeedback@hq.dhs.gov or contact the DHS 

Daily Report Team at (703) 942-8590 

Subscribe to the Distribution List: Visit the DHS Daily Open Source Infrastructure Report and follow 

instructions to Get e-mail updates when this information changes . 

Removal from Distribution List: Send mail to support@ govdelivery.com . 



Contact DHS 

To report physical infrastructure incidents or to request information, please contact the National Infrastructure 
Coordinating Center at nicc@hq.dhs.gov or (202) 282-9201. 

To report cyber infrastructure incidents or to request information, please contact US -CERT at soc@us-cert.gov or visit 
their Web page at www.us-cert.gov . 

Department of Homeland Security Disclaimer 

The DHS Daily Open Source Infrastructure Report is a non-commercial publication intended to educate and inform 
personnel engaged in infrastructure protection. Further reproduction or redistribution is subject to original copyright 
restrictions. DHS provides no warranty of ownership of the copyright, or accuracy with respect to the original source 
material. 
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